detect-secrets

No entries match these filters. Clear filters

1. v1.5.0 May 6, 2024 · release notes

   Adds five new secret detectors (IP, GitLab, Telegram, PyPI/TestPyPI, OpenAI) and OS-agnostic baseline support in detect-secrets v1.5.0.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.0 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0

   • Adds ip_address detector to scan for IP addresses
   • Adds gitlab_token detector to scan for GitLab tokens
   • Adds telegram_token detector to scan for Telegram tokens
   • Adds pypi_token and testpypi_token detectors to scan for PyPI and TestPyPI tokens
   • Adds openai_token detector to scan for OpenAI tokens

   +1 more show less

   • Supports OS-agnostic baseline files, allowing baselines generated on one OS to be used on another

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Dropped support for Python 3.6 and 3.7; these versions are no longer supported and will fail if used with this version of detect-secrets
2. 3.10 May 6, 2024 · release notes

   detect-secrets 3.10 adds five new detectors (IP, GitLab, Telegram, PyPI/TestPyPI, OpenAI) and OS-agnostic baselines

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.10 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.10

   • Added OS-agnostic baseline files support for cross-platform compatibility
   • Added a detector for IP addresses
   • Added a detector for GitLab tokens
   • Added a detector for Telegram tokens
   • Added a detector for Pypi and TestPypi tokens

   +1 more show less

   • Added a detector for OpenAI tokens

   6 details in Everything

3. v1.4.0 Oct 5, 2022 · release notes

   Adds Discord bot token detector and improves programmatic audit report parsing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.4.0 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout v1.4.0

   • Added a detector for Discord bot tokens (DiscordBotToken) to detect secrets in source code
   • Improved the audit command output format to produce a structure that is easier to parse programmatically

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.6 support is dropped in v1.5.0, so scripts running on Python 3.6 will fail with this tool starting from that version.
4. 3.6 Oct 4, 2022 · release notes

   detect-secrets v3.6 adds Discord bot token detection and heuristic support for .NET packages.lock.json

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.6 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout 3.6

   • Adds a new detector for Discord bot tokens
   • Adds support for .NET packages.lock.json files in the heuristic filter

   2 details in Everything

5. v1.3.0 Jul 22, 2022 · release notes

   Adds --json flag to detect-secrets-hook and improves arrow key detection in keyword plugins

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.3.0 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout v1.3.0

   └──▷ USE IT
   Pipe hook output into another tool that consumes JSON instead of the default text format.
   shell copy

   detect-secrets-hook --json

   • Adds --json flag to the detect-secrets-hook CLI command to return output as JSON
   • Improves keyword plugin to detect arrow key assignments

   2 details in Everything

6. July 22nd, 2022 Jul 22, 2022 · release notes

   detect-secrets adds JSON output support for detect-secrets-hook and improves keyword plugin detection

   • Adds --json flag to detect-secrets-hook to return scan results as JSON instead of plain text.
   • Improves the keyword plugin to detect secrets assigned via arrow keys.

   2 details in Everything

7. v1.2.0 Feb 16, 2022 · release notes

   Adds GitHub and SendGrid plugins, CI/CD actions, and more ignored extensions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.2.0 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout v1.2.0

   • Adds github_token plugin for detecting GitHub tokens
   • Adds sendgrid plugin for detecting SendGrid API keys
   • Adds new file extensions to the ignore list

   3 details in Everything

8. February 16th, 2022 Feb 16, 2022 · release notes

   detect-secrets adds GitHub token and SendGrid plugins for new secret detection capabilities

   • New github-token plugin added to detect secrets from the GitHub platform.
   • New sendgrid plugin added to detect secrets from the SendGrid platform.
   • Adds support for more ignored file extensions via the baseline configuration.

   3 details in Everything

9. v1.1.0 Apr 14, 2021 · release notes

   Adds optional ML-based gibberish detection and multiprocessing for faster scanning

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1.0 https://github.com/Yelp/detect-secrets.git
   # already have the repo? check out this version:
   $ git checkout v1.1.0

   • Adds (optional) ML-based gibberish-detector support to filter out non-secret noise
   • Adds multiprocessing support for parallel scan execution

   2 details in Everything

10. April 14th, 2021 Apr 14, 2021 · release notes

    detect-secrets adds gibberish filter, multiprocessing, directory args, audit report, and improved keyword detection

    └──▷ USE IT
    Speed up large repository scans using multiple CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores
    shell copy

    detect-secrets scan --multiprocessing .

    Generate a report of detected secrets from a baseline for review
    shell copy

    detect-secrets audit --report . > secrets_report.json

    Scan a specific target directory rather than the current working directory
    shell copy

    detect-secrets scan ./src/config/

    • Adds --multiprocessing option to enable faster scans via parallel processing
    • Adds gibberish filter to detect random/alphanumeric strings as secrets
    • Allows scanning specific target directories instead of just the current directory
    • Adds --report flag to audit command to extract secret values using the baseline
    • Adds alphanumerical filter requiring at least one letter or number in detected secrets

    +2 more show less

    • Adds new filters to ignore common lock files and swagger files by extension
    • KeywordDetector now defaults to requiring quotes around secrets for accuracy

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Baseline migration from version <0.12 renames exclude key to exclude-files instead of exclude-lines
11. February 24th, 2021 Feb 24, 2021 · release notes

    detect-secrets adds new detectors (NPM, Azure, Square), baseline slimming, and filter/plugin disabling flags

    └──▷ TRY IT
    Generate a compact baseline file to reduce git history bloat
    copy

    $ detect-secrets scan --slim > .secrets.baseline

    Exclude specific secrets matching a regex from scan results
    copy

    $ detect-secrets scan --exclude-secrets 'TEST-KEY-[0-9]+' ./src

    Use inline comments to allowlist the next line in source code without configuring a baseline
    📍# pragma: allowlist nextline secret const password = '…';
    • Adds NpmDetector, AzureStorageKeyDetector, and SquareOauthDetector to expand secret detection coverage beyond AWS
    • Adds --only-allowlisted flag to scan for inline ignores
    • Adds --slim flag to generate baselines that minimize git diffs
    • Adds --exclude-secrets flag to ignore secrets that match specific regexes
    • Adds --disable-filter and --disable-plugin flags to selectively disable scanning components

    +2 more show less

    • Adds support for # pragma: allowlist nextline secret comment to ignore the following line in source code
    • Adds --list-all-plugins command-line option to show a list of all plugins available to the engine

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Core engine and module APIs have changed significantly, requiring migration for users interacting with detect-secrets as a library
12. August 27th, 2020 Aug 27, 2020 · release notes

    detect-secrets August 2020 release includes accuracy improvements and bug fixes

    • Verify Slack secrets more accurately

    1 detail in Everything

13. July 9th, 2020 Jul 9, 2020 · release notes

    detect-secrets adds support for custom plugins to extend detection capabilities.

    • Add support for custom plugins

    1 detail in Everything

14. March 26th, 2020 Mar 26, 2020 · release notes

    Adds IBM Cloudant, IBM COS HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it., and Twilio plugins; adds DETECT_SECRETS_SECURITY_TEAM env var

    • Adds a plugin for IBM's Cloudant to detect secrets in Cloudant databases.
    • Adds a plugin for IBM Cloud Object Storage HMAC to detect secrets in COS HMAC keys.
    • Adds a Twilio plugin to detect secrets in Twilio credentials.
    • Supports DETECT_SECRETS_SECURITY_TEAM environment variable to customize the pre-commit hook error message.

    4 details in Everything

15. October 28th, 2019 Oct 28, 2019 · release notes

    detect-secrets adds Softlayer plugin and URL-safe base64 support in the base64 detector.

    • Adds Softlayer plugin to detect secrets stored in IBM Softlayer environments
    • Extends the base64 plugin to recognize URL-safe base64 encoded strings

    2 details in Everything

16. September 23rd, 2019 Sep 23, 2019 · release notes

    detect-secrets v0.12.x adds JwtTokenDetector, Mailchimp/Stripe verification, and --word-list filtering

    • Adds JwtTokenDetector plugin to detect JSON Web Tokens in scanned files
    • Adds --word-list option to filter secrets based on contained words (requires pip install detect-secrets[word_list])
    • Adds verification for Mailchimp API keys via new detection logic
    • Adds verification for Stripe secret API keys via new detection logic

    4 details in Everything

17. September 16th, 2019 Sep 16, 2019 · release notes

    detect-secrets v0.12.5 adds MailchimpDetector plugin and Slack webhook verification

    • Adds MailchimpDetector plugin for detecting Mailchimp secrets
    • Adds verification capability for Slack webhooks

    2 details in Everything

18. July 23rd, 2019 Jul 23, 2019 · release notes

    detect-secrets v0.13.0 adds Slack webhook detection, multi-file/repo scanning, AWS/Slack key verification, and audit --display-results.

    • Added webhook detection to SlackDetector plugin
    • Added support for scanning multiple files
    • Added support for scanning multiple repositories
    • Added verification for AWS access keys and Slack tokens
    • Added an audit --display-results feature to aid plugin development

    5 details in Everything

19. May 13th, 2019 May 13, 2019 · release notes

    Adds ArtifactoryDetector plugin, Go string assignment detection, and inline whitelist comment support

    └──▷ HOW TO FIND IT
    Ignore a line containing a false positive using the new XML inline comment directive.
    📍// detect-secrets: ignore this line
    • Adds an ArtifactoryDetector plugin to detect secrets in Artifactory URLs
    • Adds support for Golang string assignments in the KeywordDetector plugin
    • Adds support for XML inline whitelisting comments to ignore specific lines

    3 details in Everything

20. February 11th, 2019 Feb 11, 2019 · release notes

    detect-secrets adds SlackDetector, --use-all-plugins to update, and new exclude args for scan.

    └──▷ USE IT
    Scan a repository while excluding specific file patterns or line numbers containing false positives.
    shell copy

    detect-secrets scan --exclude-files '.*\.min\.js' --exclude-lines '10-20' . > .secrets.baseline

    Update the baseline to include detections from all available plugins, not just those previously active.
    shell copy

    detect-secrets scan --use-all-plugins . > .secrets.baseline

    • Adds --use-all-plugins argument to update that adds all plugins to the baseline
    • Adds SlackDetector plugin for detecting secrets in Slack configurations or tokens
    • Adds --exclude-files and --exclude-lines arguments to scan
    • Relaxes spaces required before inline pragma: whitelist secret comment

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the --exclude CLI scan argument; use --exclude-files and --exclude-lines instead
21. November 26th, 2018 Nov 26, 2018 · release notes

    Adds audit --diff to detect secrets in changes and auto-updates pre-commit baseline

    └──▷ TRY IT
    Scan only added or modified lines in a working directory for secrets before committing.
    copy

    $ detect-secrets audit --diff

    • Made the pre-commit hook automatically update the baseline file
    • Added display of secret type in audit functionality

    2 details in Everything

22. September 12th, 2018 Sep 12, 2018 · release notes

    detect-secrets adds BasicAuthDetector plugin, adhoc string checking CLI, and a back option for valid secret checks

    └──▷ USE IT
    Check if a specific string is a valid secret interactively.
    shell copy

    detect-secrets
    > Is this a valid secret?
    > password123
    > no
    > (b)ack

    Check strings in an adhoc manner via stdin.
    shell copy

    echo "my_secret_token" | detect-secrets scan --stdin

    • Adds BasicAuthDetector plugin to detect basic authentication credentials
    • Adds CLI functionality to check strings in an adhoc manner
    • Adds a (b)ack option to 'Is this a valid secret?'

    3 details in Everything

23. August 1st, 2018 Aug 1, 2018 · release notes

    detect-secrets adds --all-files scan option and YAML inline whitelisting support

    └──▷ USE IT
    Scan all files in the repository using the new global flag.
    shell copy

    detect-secrets scan --all-files

    Update the baseline with new findings using the renamed argument.
    shell copy

    detect-secrets scan --update baseline.yaml

    • Adds the --all-files flag to the scan command to process every file in the repository.
    • Supports inline whitelisting comments within YAML configuration files.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --audit and --scan flags are renamed to subcommands audit and scan.
    • !The scan --import <baseline> argument is replaced by scan --update <baseline>.
24. June 27th, 2018 Jun 27, 2018 · release notes

    detect-secrets 0.12 adds baseline migration, audit commands, and refined PrivateKeyPlugin heuristics.

    └──▷ TRY IT
    Migrate an existing detect-secrets baseline file to the current schema format.
    copy

    $ detect-secrets migrate secrets.baseline

    Interactively audit a baseline file to mark false positives before committing.
    copy

    $ detect-secrets audit secrets.baseline

    • detect-secrets migrate command allows migrating baselines from older versions
    • detect-secrets audit command enables distinguishing false vs true positives in the baseline file
    • Adds secret_type field to differentiate Base64HighEntropyStrings and HexHighEntropyStrings in output

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed SensitivityValues config key; plugin configs no longer use this structure
    • !Base64HighEntropyStrings and HexHighEntropyStrings are now differentiated by the secret_type field instead of being lumped together